changed indentation for consistency with the rest of propellor

This commit is contained in:
Joey Hess 2014-10-31 10:20:34 -04:00
parent 63560cde90
commit 3a1f058c64
1 changed files with 46 additions and 41 deletions

View File

@ -2,10 +2,15 @@
-- --
-- Copyright 2014 Arnaud Bailly <arnaud.oqube@gmail.com> -- Copyright 2014 Arnaud Bailly <arnaud.oqube@gmail.com>
-- License: BSD-2-Clause -- License: BSD-2-Clause
module Propellor.Property.Firewall( module Propellor.Property.Firewall (
rule, rule,
installed, installed,
Chain(..),Target(..),Proto(..),Rules(..),ConnectionState(..)) where Chain(..),
Target(..),
Proto(..),
Rules(..),
ConnectionState(..)
) where
import Data.Monoid import Data.Monoid
import Data.Char import Data.Char
@ -22,20 +27,21 @@ installed = Apt.installed ["iptables"]
rule :: Chain -> Target -> Rules -> Property rule :: Chain -> Target -> Rules -> Property
rule c t rs = property ("firewall rule: " <> show r) addIpTable rule c t rs = property ("firewall rule: " <> show r) addIpTable
where where
r = Rule c t rs r = Rule c t rs
addIpTable = liftIO $ do addIpTable = liftIO $ do
let args = toIpTable r let args = toIpTable r
exist <- boolSystem "/sbin/iptables" (chk args) exist <- boolSystem "/sbin/iptables" (chk args)
if exist then if exist
return NoChange then return NoChange
else ifM (boolSystem "/sbin/iptables" (add args)) else ifM (boolSystem "/sbin/iptables" (add args))
( return MadeChange , return FailedChange) ( return MadeChange , return FailedChange)
add params = (Param "-A") : params add params = (Param "-A") : params
chk params = (Param "-C") : params chk params = (Param "-C") : params
toIpTable :: Rule -> [CommandParam] toIpTable :: Rule -> [CommandParam]
toIpTable r = map Param ((show $ ruleChain r) : toIpTable r = map Param $
(toIpTableArg (ruleRules r)) ++ [ "-j" , show $ ruleTarget r ]) (show $ ruleChain r) :
(toIpTableArg (ruleRules r)) ++ [ "-j" , show $ ruleTarget r ]
toIpTableArg :: Rules -> [String] toIpTableArg :: Rules -> [String]
toIpTableArg Everything = [] toIpTableArg Everything = []
@ -46,41 +52,40 @@ toIpTableArg (IFace iface) = ["-i", iface]
toIpTableArg (Ctstate states) = ["-m", "conntrack","--ctstate", concat $ intersperse "," (map show states)] toIpTableArg (Ctstate states) = ["-m", "conntrack","--ctstate", concat $ intersperse "," (map show states)]
toIpTableArg (r :- r') = toIpTableArg r <> toIpTableArg r' toIpTableArg (r :- r') = toIpTableArg r <> toIpTableArg r'
data Rule = Rule { data Rule = Rule
ruleChain :: Chain { ruleChain :: Chain
,ruleTarget :: Target , ruleTarget :: Target
,ruleRules :: Rules , ruleRules :: Rules
} deriving (Eq, Show, Read) } deriving (Eq, Show, Read)
data Chain = INPUT | OUTPUT | FORWARD data Chain = INPUT | OUTPUT | FORWARD
deriving (Eq,Show,Read) deriving (Eq,Show,Read)
data Target = ACCEPT | REJECT | DROP | LOG data Target = ACCEPT | REJECT | DROP | LOG
deriving (Eq,Show,Read) deriving (Eq,Show,Read)
data Proto = TCP | UDP | ICMP data Proto = TCP | UDP | ICMP
deriving (Eq,Show,Read) deriving (Eq,Show,Read)
type Port = Int type Port = Int
data ConnectionState = ESTABLISHED | RELATED | NEW | INVALID data ConnectionState = ESTABLISHED | RELATED | NEW | INVALID
deriving (Eq,Show,Read) deriving (Eq,Show,Read)
data Rules = Everything data Rules
| Proto Proto = Everything
-- ^There is actually some order dependency between proto and port so this should be a specific | Proto Proto
-- data type with proto + ports -- ^There is actually some order dependency between proto and port so this should be a specific
| Port Port -- data type with proto + ports
| PortRange (Port,Port) | Port Port
| IFace Network.Interface | PortRange (Port,Port)
| Ctstate [ ConnectionState ] | IFace Network.Interface
| Rules :- Rules -- ^Combine two rules | Ctstate [ ConnectionState ]
deriving (Eq,Show,Read) | Rules :- Rules -- ^Combine two rules
deriving (Eq,Show,Read)
infixl 0 :- infixl 0 :-
instance Monoid Rules where instance Monoid Rules where
mempty = Everything mempty = Everything
mappend = (:-) mappend = (:-)